NetSight
IP …
medium6.5

CVE-2013-4016

SQL injection vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.201…

Impact

SQL injection vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140207-1801, and 7.1.1.12 before IFIX.20140218-1510 allows remote authenticated users to execute arbitrary SQL commands via a Birt report with a WHERE clause in plain text.

Affected products

VendorProductAffected versions
IbmChange And Configuration Management Database
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmMaximo Service Desk
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmTivoli Asset Management For It
Versions 7.0, 7.1
IbmTivoli It Asset Management For It
Versions 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmTivoli Service Request Manager
Versions 7.1.1, 7.1.1.7, 7.1.1.11, 7.1.1.12
IbmSmartcloud Control Desk
Versions 7.0, 7.5, 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.1.0
IbmMaximo Asset Management
Versions 7.5.0.0, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.0.4, 7.5.0.5

Weakness classification

CWE-89

References